File name:

x64_x32_installer__v4.2.2.msi

Full analysis: https://app.any.run/tasks/b08d6d0f-21d1-45ae-a8f7-5bb79db95f47
Verdict: Malicious activity
Analysis date: August 23, 2024, 16:47:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
robotdropper
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {A06E125F-2A1D-4491-AE35-1E59BECF7A5D}, Number of Words: 10, Subject: IcuApp, Author: Icuuq Cmpq, Name of Creating Application: IcuApp, Template: x64;2057, Comments: This installer database contains the logic and data required to install IcuApp., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Aug 22 11:36:04 2024, Last Saved Time/Date: Thu Aug 22 11:36:04 2024, Last Printed: Thu Aug 22 11:36:04 2024, Number of Pages: 450
MD5:

B8DA67923E70736F23F50E188B9B12A9

SHA1:

C695C02AD88616D21F730C1248E885E1849C9671

SHA256:

AB31AF0388712C0DC00D974B15EE40888D3D65207FD81FA5148A832186C60504

SSDEEP:

196608:rnKDHPKOFfXWZQHvOJgdbOIkVBqjgnMn86M0WFd5ljUaWR261zVzg:2rJZm7xBJnM86Q/BUaW/Jpg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ROBOTDROPPER has been detected

      • msiexec.exe (PID: 6936)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6936)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6988)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 6936)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6988)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6936)

    • The process executes via Task Scheduler

      • default-browser-agent.exe (PID: 4248)

    • Loads DLL from Mozilla Firefox

      • default-browser-agent.exe (PID: 4248)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 6824)

    • Reads the computer name

      • msiexec.exe (PID: 6936)
      • msiexec.exe (PID: 6988)

    • Checks supported languages

      • msiexec.exe (PID: 6936)
      • msiexec.exe (PID: 6988)
      • rnpkeys.exe (PID: 1684)
      • default-browser-agent.exe (PID: 4248)
      • rnpkeys.exe (PID: 4068)
      • rnpkeys.exe (PID: 4976)

    • Reads Environment values

      • msiexec.exe (PID: 6988)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6936)
      • WinRAR.exe (PID: 6712)

    • Checks proxy server information

      • msiexec.exe (PID: 6988)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6988)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6988)
      • msiexec.exe (PID: 6936)

    • Reads the software policy settings

      • msiexec.exe (PID: 6988)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6936)

    • Manual execution by a user

      • WinRAR.exe (PID: 6712)
      • rnpkeys.exe (PID: 3852)
      • rnpkeys.exe (PID: 1684)
      • rnpkeys.exe (PID: 4068)
      • rnpkeys.exe (PID: 4976)

    • Application launched itself

      • firefox.exe (PID: 5264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {A06E125F-2A1D-4491-AE35-1E59BECF7A5D}
Words: 10
Subject: IcuApp
Author: Icuuq Cmpq
LastModifiedBy: -
Software: IcuApp
Template: x64;2057
Comments: This installer database contains the logic and data required to install IcuApp.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:08:22 11:36:04
ModifyDate: 2024:08:22 11:36:04
LastPrinted: 2024:08:22 11:36:04
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
16
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs #ROBOTDROPPER msiexec.exe msiexec.exe rundll32.exe no specs winrar.exe rnpkeys.exe no specs conhost.exe no specs rnpkeys.exe conhost.exe no specs rnpkeys.exe no specs conhost.exe no specs rnpkeys.exe no specs conhost.exe no specs default-browser-agent.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rnpkeys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1684"C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe" C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe
explorer.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
115.6.0
Modules
Images
c:\users\admin\appdata\roaming\icuuq cmpq\icuapp\rnpkeys.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rnpkeys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rnpkeys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3852"C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe" C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe—explorer.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
3221225781
Version:
115.6.0
Modules
Images
c:\users\admin\appdata\roaming\icuuq cmpq\icuapp\rnpkeys.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4068"C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe" C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe—explorer.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
115.6.0
Modules
Images
c:\users\admin\appdata\roaming\icuuq cmpq\icuapp\rnpkeys.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\users\admin\appdata\roaming\icuuq cmpq\icuapp\rnp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
4248"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task "308046B0AF4A39CB"C:\Program Files\Mozilla Firefox\default-browser-agent.exe—svchost.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
2147500037
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\default-browser-agent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
4976"C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe" C:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\rnpkeys.exe—explorer.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
115.6.0
Modules
Images
c:\users\admin\appdata\roaming\icuuq cmpq\icuapp\rnpkeys.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\users\admin\appdata\roaming\icuuq cmpq\icuapp\rnp.dll
c:\windows\system32\win32u.dll
5264"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe—default-browser-agent.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
3
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
5532"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
3
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
10 399
Read events
10 168
Write events
222
Delete events
9

Modification events

(PID) Process:(6936) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
181B00000FFF4D297CF5DA01
(PID) Process:(6936) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
7A599F3E2387DA9871A31E16FF6D8DF8079B660F267845C502DA5E242450B788
(PID) Process:(6936) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6988) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
70
Suspicious files
38
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
6936msiexec.exeC:\Windows\Installer\11ea2e.msi —
MD5:—
SHA256:—
6936msiexec.exeC:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\jmods\java.base.jmod —
MD5:—
SHA256:—
6936msiexec.exeC:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\srv\classes.jsa —
MD5:—
SHA256:—
6936msiexec.exeC:\Users\admin\AppData\Roaming\Icuuq Cmpq\IcuApp\srv\classes_nocoops.jsa —
MD5:—
SHA256:—
6936msiexec.exeC:\Windows\Installer\MSIEC33.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
6936msiexec.exeC:\Windows\Installer\MSIED9D.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
6936msiexec.exeC:\Windows\Installer\MSIEB18.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
6936msiexec.exeC:\Windows\Installer\MSIF763.tmpexecutable
MD5:54D74546C6AFE67B3D118C3C477C159A
SHA256:F9956417AF079E428631A6C921B79716D960C3B4917C6B7D17FF3CB945F18611
6936msiexec.exeC:\Windows\Installer\MSIF704.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
6936msiexec.exeC:\Windows\Installer\MSIECA1.tmpexecutable
MD5:B158D8D605571EA47A238DF5AB43DFAA
SHA256:CA763693CC25D316F14A9EBAD80EBF00590329550C45ADB7E5205486533C2504
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6988
msiexec.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6988
msiexec.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
1076
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6560
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2720
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1432
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
192.168.100.255:138
—
—
—
whitelisted
6988
msiexec.exe
188.114.97.3:443
get-license4.com
CLOUDFLARENET
NL
unknown
6988
msiexec.exe
142.250.184.195:80
c.pki.goog
GOOGLE
US
whitelisted
1076
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1076
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1432
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
get-license4.com
  • 188.114.97.3
  • 188.114.96.3
malicious
c.pki.goog
  • 142.250.184.195
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
Process
Message
rnpkeys.exe
Folder has been created!
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
x64_x32_installer__v4.2.2.msi